Chloe Chamberland
November 14, 2024

Wordfence Intelligence Weekly WordPress Vulnerability Report (November 4, 2024 to November 10, 2024)

🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through December 9th, 2024:

  • All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
  • All plugins and themes with 50-999 active installs hosted in the WordPress.org repository and updated within the last 2 years are in-scope for all researchers!
  • Minimum bounty of $5 for all valid in-scope submissions.
  • All researchers earn automatic bonuses of between 5% to 180% for valid submissions
  • Pending report limits are increased for all
  • It’s possible to earn up to $31,200 for high impact vulnerabilities!

Last week, there were 293 vulnerabilities disclosed in 278 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 45 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 20,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 94
Unpatched 199

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Medium Severity 259
High Severity 14
Critical Severity 20

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 232
Unrestricted Upload of File with Dangerous Type 11
Missing Authorization 10
Authorization Bypass Through User-Controlled Key 7
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 7
Exposure of Sensitive Information to an Unauthorized Actor 6
Improper Authentication 4
Improper Control of Generation of Code ('Code Injection') 4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 3
Server-Side Request Forgery (SSRF) 2
Authentication Bypass Using an Alternate Path or Channel 1
Cross-Site Request Forgery (CSRF) 1
Improper Access Control 1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 1
Improper Handling of Missing Values 1
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 1
Insecure Storage of Sensitive Information 1

Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
123
32
Gab
21
17
8
6
6
6
6
6
5
4
4
4
3
3
3
3
2
2
2
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
140+ Widgets | Xpro Addons For Elementor – FREE xpro-elementor-addons
AA Audio Player aa-audio-player
AchillesTheme-shortcodes achilles-shortcodes
Active Products Tables for WooCommerce. Use constructor to create tables  profit-products-tables-for-woocommerce
adBuddy+ (AdBlocker Detection) by NetfunkDesign adbuddy-adblocker-detection
Add Ribbon Shortcode add-ribbon
Admin Amplify wpr-admin-amplify
Advanced Video Player with Analytics advanced-video-player-with-analytics
Adventure Bucket List adventure-bucket-list
AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress agendapress
Ajax Content Filter ajax-content-filter
Alert Me! alert-me
Algori PDF Viewer algori-pdf-viewer
Anant Addons for Elementor anant-addons-for-elementor
Assist24 Help Desk assist24it
Attesa Extra attesa-extra
audioCase audiocase
Awesome Fitness Testimonials awesome-fitness-testimonials
Awesome Tool Tip awesome-tool-tip
AzonBox azonbox
Bamboo Enquiries bamboo-enquiries
Banner System banner-system
Basticom Framework basticom-framework
Be Shortcodes be-shortcodes
Beacon For Help Scout beacon-for-helpscout
BeBetter Social Icons bebetter-social-icons
best bootstrap widgets for elementor best-bootstrap-widgets-for-elementor
Bg Patriarchia BU bg-patriarchia-bu
Bing Search API Integration abbs-bing-search
Bitcoin Payments bitcoin-payments
Blocks Post Grid blocks-post-grid
Boombox Shortcode Plugin boombox-shortcode
Brand my Footer brand-my-footer
Browsing History browsing-history
BU Slideshow bu-slideshow
Buooy Sticky Header buooy-sticky-header
Category Ajax Filter category-ajax-filter
CE21 Suite ce21-suite
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More charitable
Charity Addon for Elementor charity-addon-for-elementor
Christian Science Bible Lesson Subjects christian-science-bible-lesson-subjects
Code Embed simple-embed-code
codeSnips codesnips
Combo WP Rewrite Slugs combo-wp-rewrite-slugs
Community Yard Sale community-yard-sale
Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension
Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on
Content Slider Block content-slider-block
Content Syndication Toolkit Reader content-syndication-toolkit-reader
Conversion Helper conversion-helper
Cookie Nonsense for YT yt-cookie-nonsense
Countdown Timer block – Display the event's date into a timer. countdown-time
Cowidgets – Elementor Addons cowidgets-elementor-addons
Creative Blocks – Ultimate Blocks for Gutenberg creative-blocks
CRM 2go – Formulario de contacto crm2go
CRM WordPress Plugin – RepairBuddy computer-repair-shop
Custom Dashboard Widget create-custom-dashboard-widget
Custom URL Shortener custom-url-shorter
Daily Image daily-image
Dashing Memberships dashing-memberships
Debug Tool debug-tool
Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler cf7-styler
Don't Break The Code dont-break-the-code
Doofinder doofinder
drop in image slideshow gallery drop-in-image-slideshow-gallery
DuoGeek – Gutenberg Blocks duogeek-blocks
Dynamic Post Grid Elementor Addon dynamic-post-grid-elementor-addon
Easy Social Sharebar easy-social-sharebar
Easy SVG Support easy-svg
eewee admin custom eewee-admincustom
Ekiline Block Collection ekiline-block-collection
EleForms – All In One Form Integration including DB for Elementor all-contact-form-integration-for-elementor
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) bdthemes-element-pack-lite
ElementsReady Addons for Elementor element-ready-lite
Embed documents shortcode embed-documents-shortcode
Envo Extra envo-extra
ESB Testimonials esb-testimonials
Event post event-post
EventPress wp-eventpress
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin everest-backup
Everest Forms – Build Contact Forms, Surveys, Polls, Quizzes, Newsletter & Application Forms, and Many More with Ease! everest-forms
Fabrica Synced Pattern Instances fabrica-reusable-block-instances
Faltu Testimonial Rotator faltu-testimonial-rotator
Fancy User List fancy-user-listing
Fast Video and Image Display fast-video-and-image-display
Featured product by category name featured-product-by-category-name
File Select Control For Elementor file-select-control-for-elementor
Firework Shoppable Live Video firework-videos
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder form-maker
Forms forms-by-made-it
Forms: 3rd-Party Post Again forms-3rdparty-post-again
FOX – Currency Switcher Professional for WooCommerce woocommerce-currency-switcher
FriendStore for WooCommerce friendstore-for-woocommerce
Gboy Custom Google Map gboy-custom-google-map
Geoportail Shortcode geoportail-shortcode
Geotagged Media geotagged-media
Google Visualization Charts google-visualization-charts
GreenCon – Table, Listing, Marketing builder for Gutenberg greencon
Gutenium Blocks gutenium
HB AUDIO GALLERY hb-audio-gallery
Heateor Social Login WordPress heateor-social-login
Hola Free Video Player hola-free-video-player
Horsemanager fruitcake-horsemanager
HQ60 Fidelity Card hq60-fidelity-card
I Plant A Tree i-plant-a-tree
IA Map Analytics Basic ia-map-analytics-basic
Icon Widget icon-widget-with-links
Image Carousel Shortcode image-carousel-shortcode
Image Classify image-classify
imPress wp-js-impress
Inline Click To Tweet inline-click-to-tweet
IntelliWidget Elements intelliwidget-elements
Jigoshop – Store Toolkit jigoshop-store-toolkit
JobSearch WP Job Board wp-jobsearch
Keymaster Chord Notation Free keymaster-chord-notation-free
Kings Tab Slider kings-tab-slider
L Squared Hub WP – Virtual Device Plugin l-squared-hub-wp-virtual-device
Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages landing-page-cat
Lead capture, gated content & newsletter opt-ins bread-butter
Lenxel Core lenxel-core
Leopard - WordPress Offload Media leopard-wordpress-offload-media
Lewe Bootstrap Visuals shortcode-bootstrap-visuals
LIQUID BLOCKS – Slider, Carousel, Accordion liquid-blocks
Location Click Map location-click-map
Loginizer loginizer
Loginizer Security loginizer-security
Loginplus loginplus
Logo Slider cb-logo-slider
Luzuk Slider luzuk-slider
Luzuk Team luzuk-team
Luzuk Testimonials luzuk-testimonials
Mage Front End Forms mage-forms
Magic Slider magic-slider
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) magical-addons-for-elementor
Map Store Locator map-store-location
Mapme mapme
MapPress Maps for WordPress mappress-google-maps-for-wordpress
Master Bar master-bar
MDC YouTube Downloader mdc-youtube-downloader
mFolio Lite mfolio-lite
MG Post Contributors mg-post-contributors
Minical Hotel Booking Plugin minical
Mobile Kiosk mobile-kiosk
Moka Get Posts Shortcode moka-get-posts
Moose Elementor Kit moose-elementor-kit
Multi-day Booking Calendar multi-day-booking-calendar
Multifox Plus multifox-plus
Multiple Votes in one page multiple-votes-in-one-page
My Restaurant Menu my-restaurant-menu
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. mycred
Narnoo Commerce Manager narnoo-commerce-manager
News Articles news-articles
News Ticker newsticker
NV Slider nv-slider
Official SalesWizard CRM official-saleswizard-crm
Olympus Shortcodes olympus-shortcodes
OpenCart Product Display opencart-product-display
OS BXSlider os-bxslider
OS Our Team os-our-team
OS Pricing Tables os-pricing-tables
OSM – OpenStreetMap osm
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction paid-member-subscriptions
Parallaxer – Parallax Effect on Content parallaxer-lite-parallax-effects-on-images
ParOne Feeds parone
Pay With Stripe – Your WordPress Payments Stripe Gateway payments-stripe-gateway
Pdf Embedder Fay pdf-embedder-fay
Persian Nested Show/Hide Text persian-nested-showhide-text
PF Timer pf-timer
Photo Gallery by 10Web – Mobile-Friendly Image Gallery photo-gallery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery nextgen-gallery
Photographer Connections photographer-connections
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons contest-gallery
Plenigo plenigo
Poll Maker – Versus Polls, Anonymous Polls, Image Polls poll-maker
Popup Image popup-image
Postcasa Shortcode postcasa
Postify: Post Layout For Elementor postify-for-elementor
Posts Filter posts-filter
Posts Search posts-search
Pricing Tables WordPress Plugin – Easy Pricing Tables easy-pricing-tables
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) bdthemes-prime-slider-lite
Pro Addons For Elementor pro-addons-for-elementor
PropertyShift propertyshift
Provide Forex Signals provide-forex-signals
Pull This pull-this
Quform - WordPress Form Builder quform
ra_qrcode ra-qrcode
Realty by BestWebSoft realty
Redirecter shortcode-for-redirection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login custom-registration-form-builder-with-submission-manager
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates responsive-addons-for-elementor
Responsive Data Table responsive-data-table
Responsive Filterable Portfolio responsive-filterable-portfolio
Rig Elements For Elementor rig-elements
RSV 360 View rsv-360-view
RSV PDF Preview rsv-pdf-preview
Saragna – Social Stream WordPress saragna-social-stream
Satisfaction Reports from Help Scout happiness-reports-for-help-scout
scrollup scrollup
Search order by product SKU for WooCommerce search-order-by-product-sku-for-woocommerce
Sell Media File with Stripe sell-media-file
Semantic Shortcode semantic-shortcode
Seriously Simple Podcasting seriously-simple-podcasting
Share Buttons – Social Media rich-web-share-button
Shortcode Collection shortcode-collection
Shortcodes Blocks Creator Ultimate ultimate-shortcodes-creator
Simple Modal simplemodal
Simple Shortcode for Google Maps simple-google-maps-short-code
Simple Social Share Block simple-social-share-block
SimpleGMaps simplegmaps
Simplistic SEO simplistic-seo
Simpul Events by Esotech simpul-events-by-esotech
SKT Addons for Elementor skt-addons-for-elementor
Smooth Maps colour-smooth-maps
Social button social-button
Social Locker – Increase Traffic social-locker-content
Social Share, Social Login and Social Comments Plugin – Super Socializer super-socializer
SrcSet Responsive Images for WordPress truenorth-srcset
Stylish Internal Links stylish-internal-links
Surbma | Font Awesome surbma-font-awesome
SV Forms sv-forms
SVT Simple svt-simple
SysBasics Customize My Account for WooCommerce customize-my-account-for-woocommerce
Team Showcase and Slider – Team Members Builder team-showcase-ultimate
TeleAdmin teleadmin
Testimonial Slider Shortcode testimonial-slider-shortcode
Text Advertisements text-advertisements
The Novel Design Store Directory noveldesign-store-directory
The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) the-pack-addon
Tickera – WordPress Event Ticketing tickera-event-ticketing-system
Tigris Flexplatform tigris-flexplatform
TinyCode tinycode
Topbar ID for Elementor topbar-id-for-elementor
Trendy Restaurant Menu – Best Restaurant Plugin for WordPress trendy-restaurant-menu
Tumult Hype Animations tumult-hype-animations
Twitter real time search scrolling twitter-real-time-search-scrolling
Ultimate Accordion ultimate-accordion
Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) header-footer-elementor
Ultimate Bootstrap Elements for Elementor ultimate-bootstrap-elements-for-elementor
Ultimate Flipbox Addon for Elementor ultimate-flipbox-addon-for-elementor
User Meta – User Profile Builder and User management plugin user-meta
User Password Reset user-password-reset
Utech Spinning Earth utech-spinning-earth
UW Freelancer uw-freelancer
Video Gallery for WooCommerce video-wc-gallery
VP Sitemap vp-sitemap
Wd-image-magnifier-xoss wd-image-magnifier-xoss
WE – Client Logo Carousel we-client-logo-carousel
Web Stories Widgets For Elementor shortcodes-for-amp-web-stories-and-elementor-widget
Websand Subscription Form websand-subscription-form
Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera wp-website-creator
Wezido – Elementor Addon Based on Easy Digital Downloads wezido-elementor-addon-based-on-easy-digital-downloads
WooCommerce - Social Login woo-social-login
WooCommerce Report ithemelandco-woo-report
WooCommerce Support Ticket System woocommerce-support-ticket-system
WordPress User Extra Fields wp-user-extra-fields
WoW Guild Armory Roster guild-armory-roster
WP Agenda wp-agenda
WP Contest wp-contest
WP Listings Pro wp-listings-pro
WP Membership wp-membership
WP MMenu Lite wp-mmenu-lite
WP PagSeguro Payments wp-pagseguro-payments
WP Photo Album Plus wp-photo-album-plus
WP Responsive Video my-wp-responsive-video
Wp Slide Categorywise wp-slide-categorywise
WP Virtual Room Configurator configure-conference-room
WP Visual Adverts wp-visual-adverts
WP-Basics wp-basics
wp_automatic_widget wp-automatic-widget
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More wpforms-lite
WPHelpful wphelpful
WS Form LITE – Drag & Drop Contact Form Builder for WordPress ws-form
XT Floating Cart for WooCommerce woo-floating-cart-lite
YaDisk Files wp-yadisk-files
yPHPlista yphplista
Zotpress zotpress
活动链接推广插件 yr-activity-link

WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Anih - Creative Agency WordPress Theme anih
Storely storely
Th Shop Mania th-shop-mania
Top Store top-store
WPLMS Learning Management System for WordPress, WordPress LMS wplms

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload

10.0
CVSS Rating
Critical (10.0)
CVE-ID
CVE-2024-8615
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
JobSearch WP Job Board
Researcher
More Details >

mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-9307
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
mFolio Lite
Researcher
More Details >

WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload

9.9
CVSS Rating
Critical (9.9)
CVE-ID
CVE-2024-8614
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
JobSearch WP Job Board
Researcher
More Details >

Category Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10871
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Category Ajax Filter
Researcher
More Details >

CE21 Suite <= 2.2.0 - Authentication Bypass

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10284
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
CE21 Suite
Researcher
More Details >

CE21 Suite <= 2.2.0 - JWT Token Disclosure

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10285
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
CE21 Suite
Researcher
More Details >

Computer Repair Shop <= 3.8115 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-51793
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
CRM WordPress Plugin – RepairBuddy
Researcher
More Details >

Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10586
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Debug Tool
Researcher
More Details >

Forms <= 2.8.0 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-51791
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Forms
Researcher
More Details >

HB AUDIO GALLERY <= 3.0 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-51790
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
HB AUDIO GALLERY
Researcher
More Details >

Image Classify <= 1.0.0 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-51789
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Image Classify
Researcher
More Details >

Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10589
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Leopard - WordPress Offload Media
Researcher
More Details >

Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10687
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons
Researcher
More Details >

RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10508
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Researcher
More Details >

The Novel Design Store Directory <= 4.3.0 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-51788
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
The Novel Design Store Directory
Researcher
More Details >

WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10625
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
WooCommerce Support Ticket System
Researcher
More Details >

WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10627
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
WooCommerce Support Ticket System
Researcher
More Details >

WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10801
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
WordPress User Extra Fields
Researcher
More Details >

WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10547
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
WP Membership
Researcher
More Details >

WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion

9.8
CVSS Rating
Critical (9.8)
CVE-ID
CVE-2024-10470
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
WPLMS Learning Management System for WordPress, WordPress LMS
Researcher
More Details >

Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10674
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Th Shop Mania
Researchers
More Details >

Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10673
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Top Store
Researchers
More Details >

WooCommerce Report <= 1.5.1 - Cross-Site Request Forgery to Arbitrary Options Update

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10711
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
WooCommerce Report
Researcher
More Details >

WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletion

8.8
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-10626
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
WooCommerce Support Ticket System
Researcher
More Details >

Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-10020
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Heateor Social Login WordPress
Researcher
More Details >

Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-10097
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Loginizer Security
Loginizer
Researcher
More Details >

Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-10114
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
WooCommerce - Social Login
Researcher
More Details >

Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.68 - Authentication Bypass

8.1
CVSS Rating
High (8.1)
CVE-ID
CVE-2024-9946
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Social Share, Social Login and Social Comments Plugin – Super Socializer
Researcher
More Details >

Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log

7.5
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-10028
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin
Researcher
More Details >

YaDisk Files <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

7.4
CVSS Rating
High (7.4)
CVE-ID
CVE-2024-10709
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
YaDisk Files
Researcher
More Details >

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-10261
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
Researcher
More Details >

The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-10640
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
FOX – Currency Switcher Professional for WooCommerce
Researcher
More Details >

Tickera – WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-10263
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Tickera – WordPress Event Ticketing
Researcher
More Details >

WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay

7.3
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-10958
Patch Status
Patched
Published
Nov 10, 2024
Affected Software
WP Photo Album Plus
Researcher
More Details >

CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-10294
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
CE21 Suite
Researcher
More Details >

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-9657
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)
Researcher
More Details >

Gboy Custom Google Map <= 1.2 - Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-51882
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Gboy Custom Google Map
Researcher
More Details >

Horsemanager <= 1.3 - Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-51843
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Horsemanager
Researcher
More Details >

L Squared Hub WP <= 1.0 - Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-51820
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
L Squared Hub WP – Virtual Device Plugin
Researcher
More Details >

Share Buttons – Social Media <= 1.0.2 - Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-51845
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Share Buttons – Social Media
Researcher
More Details >

User Meta – User Profile Builder and User management plugin <= 3.1 - Insecure Direct Object Reference to Sensitive Information Exposure

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-9262
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
User Meta – User Profile Builder and User management plugin
Researcher
More Details >

WP Contest <= 1.0.0 - Authenticated (Contributor+) SQL Injection

6.5
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-51837
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
WP Contest
Researcher
More Details >

AA Audio Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52348
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
AA Audio Player
Researcher
More Details >

AchillesTheme-shortcodes <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51878
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
AchillesTheme-shortcodes
Researcher
Gab
More Details >

Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10168
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Active Products Tables for WooCommerce. Use constructor to create tables 
Researcher
More Details >

Add Ribbon Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51823
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Add Ribbon Shortcode
Researcher
More Details >

Advanced Video Player with Analytics <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51824
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Advanced Video Player with Analytics
Researcher
More Details >

Adventure Bucket List <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51908
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Adventure Bucket List
Researcher
More Details >

AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51807
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
AgendaPress – Easily Publish Meeting Agendas and Programs on WordPress
Researcher
More Details >

Alert Me! <= 0.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51825
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Alert Me!
Researcher
More Details >

Anant Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51813
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Anant Addons for Elementor
Researcher
Gab
More Details >

Assist24 Help Desk <= 20150401.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51910
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Assist24 Help Desk
Researcher
More Details >

audioCase <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51909
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
audioCase
Researcher
More Details >

Awesome Fitness Testimonials <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51806
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Awesome Fitness Testimonials
Researcher
More Details >

Awesome Tool Tip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52349
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Awesome Tool Tip
Researcher
More Details >

AzonBox <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51931
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
AzonBox
Researcher
More Details >

Bamboo Enquiries <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51859
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Bamboo Enquiries
Researcher
More Details >

Banner System <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51816
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Banner System
Researcher
More Details >

Basticom Framework <= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9443
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Basticom Framework
Researcher
More Details >

Be Shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51881
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Be Shortcodes
Researcher
More Details >

Beacon For Help Scout <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51828
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Beacon For Help Scout
Researcher
More Details >

BeBetter Social Icons <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51880
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
BeBetter Social Icons
Researcher
More Details >

best bootstrap widgets for elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51851
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
best bootstrap widgets for elementor
Researcher
Gab
More Details >

Bg Patriarchia BU <= 2.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51799
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Bg Patriarchia BU
Researcher
More Details >

Bitcoin Payments <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51826
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Bitcoin Payments
Researcher
More Details >

Blocks Post Grid <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51928
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Blocks Post Grid
Researcher
Gab
More Details >

Boombox Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51827
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Boombox Shortcode Plugin
Researcher
More Details >

Brand my Footer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51801
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Brand my Footer
Researcher
More Details >

Browsing History <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51885
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Browsing History
Researcher
More Details >

BU Slideshow <= 2.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52351
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
BU Slideshow
Researcher
More Details >

Charity Addon for Elementor <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51938
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Charity Addon for Elementor
Researcher
More Details >

Christian Science Bible Lesson Subjects <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52353
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Christian Science Bible Lesson Subjects
Researcher
More Details >

Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10814
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Code Embed
Researcher
More Details >

codeSnips <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51808
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
codeSnips
Researcher
More Details >

Community Yard Sale <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51846
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Community Yard Sale
Researcher
More Details >

Cookie Nonsense for YT <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51933
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Cookie Nonsense for YT
Researcher
More Details >

Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8960
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Cowidgets – Elementor Addons
Researcher
More Details >

Creative Blocks <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51822
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Creative Blocks – Ultimate Blocks for Gutenberg
Researcher
Gab
More Details >

CRM 2go <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52350
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
CRM 2go – Formulario de contacto
Researcher
More Details >

Custom Dashboard Widget <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51860
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Custom Dashboard Widget
Researcher
More Details >

Custom URL Shortener <= 0.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51930
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Custom URL Shortener
Researcher
More Details >

drop in image slideshow gallery <= 12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51914
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
drop in image slideshow gallery
Researcher
More Details >

DuoGeek Blocks 0.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51868
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
DuoGeek – Gutenberg Blocks
Researcher
Gab
More Details >

Dynamic Post Grid Elementor Addon <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51852
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Dynamic Post Grid Elementor Addon
Researcher
Gab
More Details >

Easy Social Sharebar <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51833
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Easy Social Sharebar
Researcher
More Details >

Easy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10269
Patch Status
Patched
Published
Nov 7, 2024
Affected Software
Easy SVG Support
Researcher
More Details >

Ekiline Block Collection <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51934
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Ekiline Block Collection
Researcher
More Details >

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10493
Patch Status
Patched
Published
Nov 7, 2024
Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)
Researcher
More Details >

Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10325
Patch Status
Patched
Published
Nov 7, 2024
Affected Software
Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder)
Researcher
More Details >

ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51787
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
ElementsReady Addons for Elementor
Researcher
More Details >

Embed documents shortcode <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51904
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Embed documents shortcode
Researcher
More Details >

ESB Testimonials <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51936
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
ESB Testimonials
Researcher
More Details >

Event Post <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10186
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Event post
Researcher
More Details >

EventPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51861
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
EventPress
Researcher
More Details >

Faltu Testimonial Rotator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51853
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Faltu Testimonial Rotator
Researcher
More Details >

Fancy User List <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51889
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Fancy User List
Researcher
More Details >

Fast Video and Image Display <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51935
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Fast Video and Image Display
Researcher
More Details >

Featured product by category name <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51911
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Featured product by category name
Researcher
More Details >

File Select Control For Elementor <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51841
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
File Select Control For Elementor
Researcher
Gab
More Details >

Geoportail Shortcode <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51890
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Geoportail Shortcode
Researcher
More Details >

Google Visualization Charts <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51862
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Google Visualization Charts
Researcher
More Details >

GreenCon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51926
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
GreenCon – Table, Listing, Marketing builder for Gutenberg
Researcher
Gab
More Details >

Gutenium Blocks <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51869
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Gutenium Blocks
Researcher
Gab
More Details >

Hola Free Video Player <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51854
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Hola Free Video Player
Researcher
More Details >

I Plant A Tree <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51883
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
I Plant A Tree
Researcher
More Details >

IA Map Analytics Basic <= 20170413 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51937
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
IA Map Analytics Basic
Researcher
More Details >

Icon Widget <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51929
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Icon Widget
Researcher
Gab
More Details >

Image Carousel Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51842
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Image Carousel Shortcode
Researcher
Gab
More Details >

Inline Click To Tweet <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51803
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Inline Click To Tweet
Researcher
More Details >

IntelliWidget Elements <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51912
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
IntelliWidget Elements
Researcher
More Details >

Keymaster Chord Notation Free <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51809
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Keymaster Chord Notation Free
Researcher
More Details >

Kings Tab Slider <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51932
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Kings Tab Slider
Researcher
More Details >

Lead capture, gated content & newsletter opt-ins <= 7.4.857 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51802
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Lead capture, gated content & newsletter opt-ins
Researcher
More Details >

Lenxel Core for Lenxel(LNX) LMS <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9270
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Lenxel Core
Researcher
More Details >

Lewe Bootstrap Visuals <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51810
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Lewe Bootstrap Visuals
Researcher
More Details >

LIQUID BLOCKS <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52357
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
LIQUID BLOCKS – Slider, Carousel, Accordion
Researcher
More Details >

Location Click Map <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51844
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Location Click Map
Researcher
More Details >

Logo Slider <= 4.1.0 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10473
Patch Status
Patched
Published
Nov 7, 2024
Affected Software
Logo Slider
Researcher
More Details >

Logo Slider <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10896
Patch Status
Patched
Published
Nov 7, 2024
Affected Software
Logo Slider
Researcher
More Details >

Luzuk Slider <= 0.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51834
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Luzuk Slider
Researcher
More Details >

Luzuk Team <= 0.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51871
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Luzuk Team
Researcher
More Details >

Luzuk Testimonials <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51872
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Luzuk Testimonials
Researcher
More Details >

Mage Front End Forms <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52339
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Mage Front End Forms
Researcher
More Details >

Magic Slider <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51896
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Magic Slider
Researcher
More Details >

Map Store Locator <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51920
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Map Store Locator
Researcher
More Details >

Mapme <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51913
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Mapme
Researcher
More Details >

MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10715
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
MapPress Maps for WordPress
Researcher
More Details >

MDC YouTube Downloader <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51875
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
MDC YouTube Downloader
Researcher
More Details >

Minical Hotel Booking Plugin <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51895
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Minical Hotel Booking Plugin
Researcher
More Details >

Mobile Kiosk <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51829
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Mobile Kiosk
Researcher
More Details >

Moka Get Posts Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51804
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Moka Get Posts Shortcode
Researcher
More Details >

Moose Elementor Kit <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51856
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Moose Elementor Kit
Researcher
Gab
More Details >

Multi-day Booking Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51873
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Multi-day Booking Calendar
Researcher
More Details >

Multifox Plus <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51916
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Multifox Plus
Researcher
More Details >

Multiple Votes in one page <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51917
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Multiple Votes in one page
Researcher
More Details >

My Restaurant Menu <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51849
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
My Restaurant Menu
Researcher
More Details >

myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10187
Patch Status
Patched
Published
Nov 7, 2024
Affected Software
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program.
Researcher
More Details >

News Articles <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51897
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
News Articles
Researcher
More Details >

News Ticker <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51830
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
News Ticker
Researcher
More Details >

NV Slider <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51887
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
NV Slider
Researcher
More Details >

Official SalesWizard CRM Plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51891
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Official SalesWizard CRM
Researcher
More Details >

Olympus Shortcodes <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51857
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Olympus Shortcodes
Researcher
More Details >

OpenCart Product Display <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51835
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
OpenCart Product Display
Researcher
More Details >

OS BXSlider <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52342
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
OS BXSlider
Researcher
More Details >

OS Our Team <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52341
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
OS Our Team
Researcher
More Details >

OS Pricing Tables <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52343
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
OS Pricing Tables
Researcher
More Details >

OSM – OpenStreetMap <= 6.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52355
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
OSM – OpenStreetMap
Researcher
More Details >

Parallaxer <= 1.00 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51848
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Parallaxer – Parallax Effect on Content
Researcher
More Details >

ParOne Feeds <= 1.17.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51874
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
ParOne Feeds
Researcher
More Details >

Pay With Stripe <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51918
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Pay With Stripe – Your WordPress Payments Stripe Gateway
Researcher
More Details >

Pdf Embedder Fay <= 1.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51795
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Pdf Embedder Fay
Researcher
More Details >

pdf.js < 2.0.943 - Authenticated (Author+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2018-5158
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Algori PDF Viewer
Researcher
More Details >

Persian Nested Show/Hide Text <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51831
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Persian Nested Show/Hide Text
Researcher
More Details >

PF Timer <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51863
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
PF Timer
Researcher
More Details >

Photographer Connections <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52340
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Photographer Connections
Researcher
More Details >

Plenigo <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51832
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Plenigo
Researcher
More Details >

Popup Image <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51811
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Popup Image
Researcher
More Details >

Postcasa Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52352
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Postcasa Shortcode
Researcher
More Details >

Postify: Post Layout For Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51893
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Postify: Post Layout For Elementor
Researcher
Gab
More Details >

Posts Filter <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51886
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Posts Filter
Researcher
More Details >

Posts Search <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51884
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Posts Search
Researcher
More Details >

Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8323
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Pricing Tables WordPress Plugin – Easy Pricing Tables
Researcher
More Details >

Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-8442
Patch Status
Patched
Published
Nov 6, 2024
Affected Software
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider)
Researcher
More Details >

Pro Addons For Elementor <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51812
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Pro Addons For Elementor
Researcher
Gab
More Details >

Provide Forex Signals <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52344
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Provide Forex Signals
Researcher
More Details >

Pull This <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51838
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Pull This
Researcher
More Details >

ra_qrcode <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52345
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
ra_qrcode
Researcher
More Details >

Realty by BestWebSoft <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51786
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Realty by BestWebSoft
Researcher
More Details >

Redirecter <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51855
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Redirecter
Researcher
More Details >

Responsive Addons for Elementor <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52358
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates
Researcher
More Details >

Rig Elements For Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51927
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Rig Elements For Elementor
Researcher
Gab
More Details >

RSV 360 View <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51906
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
RSV 360 View
Researcher
More Details >

RSV PDF Preview <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51905
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
RSV PDF Preview
Researcher
More Details >

scrollup <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51921
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
scrollup
Researcher
More Details >

Sell Media File with Stripe <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51892
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Sell Media File with Stripe
Researcher
More Details >

Semantic Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51898
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Semantic Shortcode
Researcher
More Details >

Shortcode Collection <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51864
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Shortcode Collection
Researcher
More Details >

Shortcodes Blocks Creator Ultimate <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10340
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Shortcodes Blocks Creator Ultimate
Researcher
More Details >

Simple Shortcode for Google Maps <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-10621
Patch Status
Patched
Published
Nov 7, 2024
Affected Software
Simple Shortcode for Google Maps
Researcher
More Details >

Simple Social Share Block <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51865
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Simple Social Share Block
Researcher
More Details >

SimpleGMaps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52346
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
SimpleGMaps
Researcher
More Details >

Simpul Events by Esotech <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51867
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Simpul Events by Esotech
Researcher
More Details >

Smooth Maps <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51901
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Smooth Maps
Researcher
More Details >

Social button <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51866
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Social button
Researcher
More Details >

Social Locker <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51858
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Social Locker – Increase Traffic
Researcher
More Details >

Storely <= 14.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51794
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Storely
Researcher
More Details >

Stylish Internal Links <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51939
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Stylish Internal Links
Researcher
More Details >

Surbma | Font Awesome <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51798
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Surbma | Font Awesome
Researcher
More Details >

SV Forms <= 2.0.05 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51877
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
SV Forms
Researcher
More Details >

Testimonial Slider Shortcode <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51925
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Testimonial Slider Shortcode
Researcher
Gab
More Details >

Text Advertisements <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51879
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Text Advertisements
Researcher
More Details >

The Pack Elementor addons <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52356
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library)
Researcher
More Details >

Tigris Flexplatform <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51819
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Tigris Flexplatform
Researcher
More Details >

TinyCode <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51902
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
TinyCode
Researcher
More Details >

Topbar ID for Elementor <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51894
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Topbar ID for Elementor
Researcher
Gab
More Details >

Trendy Restaurant Menu <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51796
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Trendy Restaurant Menu – Best Restaurant Plugin for WordPress
Researcher
More Details >

Ultimate Accordion <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51797
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Ultimate Accordion
Researcher
More Details >

Ultimate Flipbox Addon for Elementor 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51870
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Ultimate Flipbox Addon for Elementor
Researcher
Gab
More Details >

Utech Spinning Earth <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51839
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Utech Spinning Earth
Researcher
More Details >

VP Sitemap <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51922
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
VP Sitemap
Researcher
More Details >

Wd-image-magnifier-xoss <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51840
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Wd-image-magnifier-xoss
Researcher
More Details >

WE – Client Logo Carousel <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51821
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
WE – Client Logo Carousel
Researcher
More Details >

Web Stories Widgets For Elementor <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52354
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Web Stories Widgets For Elementor
Researcher
More Details >

Websand Subscription Form <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51923
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Websand Subscription Form
Researcher
More Details >

Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-52347
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera
Researcher
More Details >

Wezido <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51836
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Wezido – Elementor Addon Based on Easy Digital Downloads
Researcher
Gab
More Details >

WoW Guild Armory Roster <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51850
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
WoW Guild Armory Roster
Researcher
More Details >

WP Agenda <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51924
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
WP Agenda
Researcher
More Details >

WP Listings Pro <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51903
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
WP Listings Pro
Researcher
More Details >

WP PagSeguro Payments <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51847
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
WP PagSeguro Payments
Researcher
More Details >

WP Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51940
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
WP Responsive Video
Researcher
More Details >

WP Virtual Room Configurator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51907
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
WP Virtual Room Configurator
Researcher
More Details >

wp_automatic_widget <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51876
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
wp_automatic_widget
Researcher
Gab
More Details >

XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-9178
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
XT Floating Cart for WooCommerce
Researcher
More Details >

yPHPlista <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51805
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
yPHPlista
Researcher
More Details >

活动链接推广插件 <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

6.4
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-51814
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
活动链接推广插件
Researcher
More Details >

Admin Amplify <= 1.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51691
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Admin Amplify
Researcher
More Details >

Ajax Content Filter <= 1.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51717
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Ajax Content Filter
Researcher
More Details >

Bing Search API Integration <= 0.3.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51692
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Bing Search API Integration
Researcher
More Details >

Buooy Sticky Header <= 0.5.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51699
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Buooy Sticky Header
Researcher
More Details >

CF7 WOW Styler <= 1.6.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51689
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler
Researcher
More Details >

Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10876
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
Researcher
More Details >

Contact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10683
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Contact Form 7 – PayPal & Stripe Add-on
Researcher
More Details >

Content Syndication Toolkit Reader <= 1.5 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51696
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Content Syndication Toolkit Reader
Researcher
More Details >

Conversion Helper <= 1.12 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10676
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Conversion Helper
Researcher
More Details >

Daily Image <= 1.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51776
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Daily Image
Researcher
More Details >

Dashing Memberships <= 1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51760
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Dashing Memberships
Researcher
More Details >

Don't Break The Code <= .3.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51779
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Don't Break The Code
Researcher
More Details >

Doofinder <= 0.5.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51697
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Doofinder
Researcher
More Details >

eewee admin custom <= 1.8.2.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51780
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
eewee admin custom
Researcher
More Details >

Fabrica Synced Pattern Instances <= 1.0.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51695
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Fabrica Synced Pattern Instances
Researcher
More Details >

Firework Shoppable Live Video <= 6.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51781
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Firework Shoppable Live Video
Researcher
More Details >

Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.30 - Reflected Cross-Site Scripting via add_query_arg Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10265
Patch Status
Patched
Published
Nov 10, 2024
Affected Software
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Researcher
More Details >

Forms: 3rd-Party Post Again <= 0.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51783
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Forms: 3rd-Party Post Again
Researcher
More Details >

FriendStore for WooCommerce <= 1.4.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51784
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
FriendStore for WooCommerce
Researcher
More Details >

Geotagged Media <= 0.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51694
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Geotagged Media
Researcher
More Details >

HQ60 Fidelity Card <= 1.8 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51713
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
HQ60 Fidelity Card
Researcher
More Details >

imPress <= 0.1.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51704
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
imPress
Researcher
More Details >

Jigoshop – Store Toolkit <= 1.4.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51712
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Jigoshop – Store Toolkit
Researcher
More Details >

Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.6 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9226
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages
Researcher
More Details >

Loginplus <= 1.2 - Unauthenticated Stored Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51782
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Loginplus
Researcher
More Details >

Master Bar <= 1.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51698
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Master Bar
Researcher
More Details >

MG Post Contributors <= 1.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51701
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
MG Post Contributors
Researcher
More Details >

Narnoo Commerce Manager <= 1.6.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51708
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Narnoo Commerce Manager
Researcher
More Details >

PropertyShift <= 1.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51762
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
PropertyShift
Researcher
More Details >

Responsive Data Table <= 1.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51710
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Responsive Data Table
Researcher
More Details >

Saragna <= 1.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51711
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Saragna – Social Stream WordPress
Researcher
More Details >

Satisfaction Reports from Help Scout <= 2.0.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51778
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Satisfaction Reports from Help Scout
Researcher
More Details >

Search order by product SKU for WooCommerce <= 0.2 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51693
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Search order by product SKU for WooCommerce
Researcher
More Details >

Seriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-9667
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Seriously Simple Podcasting
Researcher
More Details >

Simple Modal <= 0.3.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51718
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Simple Modal
Researcher
More Details >

Simplistic SEO <= 2.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51719
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Simplistic SEO
Researcher
More Details >

SrcSet Responsive Images for WordPress <= 1.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51702
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
SrcSet Responsive Images for WordPress
Researcher
More Details >

SVT Simple <= 1.0.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51759
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
SVT Simple
Researcher
More Details >

SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10837
Patch Status
Patched
Published
Nov 9, 2024
Affected Software
SysBasics Customize My Account for WooCommerce
Researcher
More Details >

Team Showcase and Slider – Team Members Builder <= 1.3 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51763
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Team Showcase and Slider – Team Members Builder
Researcher
More Details >

TeleAdmin <= 1.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51709
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
TeleAdmin
Researcher
More Details >

Twitter real time search scrolling <= 7.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51716
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Twitter real time search scrolling
Researcher
More Details >

User Password Reset <= 1.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51714
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
User Password Reset
Researcher
More Details >

UW Freelancer <= 0.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51706
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
UW Freelancer
Researcher
More Details >

WP MMenu Lite <= 1.0.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51705
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
WP MMenu Lite
Researcher
More Details >

Wp Slide Categorywise <= 1.1 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51690
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
Wp Slide Categorywise
Researcher
More Details >

WP Visual Adverts <= 2.3.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51707
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
WP Visual Adverts
Researcher
More Details >

WP-Basics <= 2.0 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51703
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
WP-Basics
Researcher
More Details >

WPHelpful <= 1.2.4 - Reflected Cross-Site Scripting

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-51761
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
WPHelpful
Researcher
More Details >

WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL

6.1
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-10647
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
WS Form LITE – Drag & Drop Contact Form Builder for WordPress
Researcher
More Details >

Anih - Creative Agency WordPress Theme <= 2024 - Authenticated (Administrator+) Stored Cross-Site Scripting

5.5
CVSS Rating
Medium (5.5)
CVE-ID
CVE-2024-9775
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Anih - Creative Agency WordPress Theme
Researcher
More Details >

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.10.2 - Authenticated (Contributor+ Stored Cross-Site Scripting via Open Map Widget

5.4
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-9867
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows)
Researcher
More Details >

Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-10779
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Cowidgets – Elementor Addons
Researcher
More Details >

EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-6626
Patch Status
Unpatched
Published
Nov 5, 2024
Affected Software
EleForms – All In One Form Integration including DB for Elementor
Researcher
More Details >

Quform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information Exposure

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-8756
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Quform - WordPress Form Builder
Researcher
More Details >

Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion

5.3
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-10535
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Video Gallery for WooCommerce
Researcher
More Details >

WordPress Poll Maker Plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injection

4.9
CVSS Rating
Medium (4.9)
CVE-ID
CVE-2024-9874
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Researcher
More Details >

Responsive Filterable Portfolio <= 1.0.22 - Server-Side Request Forgery

4.7
CVSS Rating
Medium (4.7)
CVE-ID
CVE-2024-51785
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Responsive Filterable Portfolio
Researcher
More Details >

adBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-10510
Patch Status
Unpatched
Published
Nov 7, 2024
Affected Software
adBuddy+ (AdBlocker Detection) by NetfunkDesign
Researcher
More Details >

Everest Forms <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-10471
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Everest Forms – Build Contact Forms, Surveys, Polls, Quizzes, Newsletter & Application Forms, and Many More with Ease!
Researcher
More Details >

NextGEN Gallery <= 3.39.4 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-6393
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
Researcher
More Details >

Photo Gallery by 10Web <= 1.8.30 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-9878
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Researcher
More Details >

WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-7056
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
Researcher
More Details >

YaDisk Files <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting

4.4
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-10710
Patch Status
Unpatched
Published
Nov 4, 2024
Affected Software
YaDisk Files
Researcher
More Details >

140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10319
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
140+ Widgets | Xpro Addons For Elementor – FREE
Researcher
More Details >

Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10688
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Attesa Extra
Researcher
More Details >

Combo WP Rewrite Slugs <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Settings Change

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-51817
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Combo WP Rewrite Slugs
Researcher
More Details >

Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10084
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Contact Form 7 – Dynamic Text Extension
Researcher
More Details >

Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10667
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Content Slider Block
Researcher
More Details >

Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10669
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Countdown Timer block – Display the event's date into a timer.
Researcher
More Details >

Debug Tool <= 2.2 - Missing Authorization to Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10588
Patch Status
Unpatched
Published
Nov 8, 2024
Affected Software
Debug Tool
Researcher
More Details >

Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10770
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Envo Extra
Researcher
More Details >

Magical Addons For Elementor <= 1.2.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10352
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
Researcher
More Details >

SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10693
Patch Status
Patched
Published
Nov 8, 2024
Affected Software
SKT Addons for Elementor
Researcher
More Details >

Tumult Hype Animations <= 1.9.14 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10543
Patch Status
Patched
Published
Nov 5, 2024
Affected Software
Tumult Hype Animations
Researcher
More Details >

Ultimate Bootstrap Elements for Elementor <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-10329
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Ultimate Bootstrap Elements for Elementor
Researcher
More Details >

Zotpress <= 7.3.12 - Missing Authorization

4.3
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-7429
Patch Status
Patched
Published
Nov 4, 2024
Affected Software
Zotpress
Researcher
More Details >

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Trust Your Site
to the Leader in WordPress Security

Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.

Protect Your Site

Did you enjoy this post? Share it!

LinkedIn 

Comments

No Comments

Breaking WordPress Security Research in your inbox as it happens.

Example of a news story

This site uses cookies in accordance with our Privacy Policy.